Nov 10, 2026

Tags:

cybersecurity, OT/ICS Security, technology

France Named the Freezer Saboteur. Read the Fine Print Before You Say “Iran Did It All.”

Amigos, this is the third time I’m writing about supermarket fridges, and I honestly didn’t expect a third chapter this fast.

In “The Fridge Is OT,” we had a French campaign with no confirmed attacker. In “The Fridge Is Still OT,” we had a second wave across seven countries and still nobody officially named. Both were accurate on the day they went up.

On Monday, November 9, that changed. Partly.

What France actually said

France’s Ministry for Europe and Foreign Affairs published a formal attribution. In its own words (my translation from the French): following the investigation, “France is in a position to attribute to Iran these destructive actions, carried out by the cyber-offensive unit SHAHID KAVEH, affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps.”

The ministry called it “the first cyber-offensive campaign conducted purely for sabotage purposes on the national territory.” It said France will summon Iran’s ambassador, propose new EU sanctions against the Iranian entities and individuals involved, and reserves the right to take further measures, public and non-public.

The same day, France’s Cyber Crisis Coordination Centre (C4) published a technical report, CERTFR-2026-CTI-009, marked TLP:CLEAR. It names the IRGC as the sponsor and Shahid Kaveh as the executor, based on what it calls a “faisceau d’indices,” a bundle of indicators.

That phrase matters. Mira, a bundle of indicators is how governments do attribution. It’s an intelligence judgment, not a court verdict.

What it covers, and what it doesn’t

Here’s the fine print, and por favor, read it twice.

The attribution covers one thing: the night of October 11 to 12, 2026, when refrigeration controllers at French retail sites were pushed into high-temperature defrost. The ministry says “more than 700” sites. The C4 report says “about 700.” Both are official, so I’m keeping both.

On damage, the C4 report counts fire outbreaks in “at least 15” cases. The Paris prosecutor’s communique, as quoted in the press, says “about twenty.” The ministry puts food losses at “several tens of millions of euros.” No single official total beyond that.

What France did not attribute:

The November 1 to 2 wave across Europe. The C4 report doesn’t address it, and the ministry’s text is limited to the October night and to sites in France.
The EFS blood service incident. ANSSI director general Vincent Strubel, quoted by franceinfo, said ANSSI is not taking a position on that attack at this stage. In a line franceinfo reports from his LinkedIn: “Even if the modus operandi is similar, nothing as it stands makes it possible to state that it is the same attacker.”

So if you see a headline that says “Iran attacked Europe’s fridges,” that’s not what France said. France named an attacker for its own October campaign. The rest is still open.

The evidence France put on the table

The C4 report lists four indicators. I’ll summarize them at the level the report does, no how-to:

The infrastructure used in the attack was also used, during the same period, for reconnaissance on Schneider Electric equipment in small and medium energy and water production units, using Modbus on port 502. C4 says Shahid Kaveh has used those techniques since at least April 2026.
The operators used the FOFA internet scanning tool, which C4 says this group habitually uses.
The attack was relayed from October 13 on CyberbanNews, a propaganda outlet C4 associates with the unit.
Traces of Farsi were found in the attack infrastructure.

The prosecutor, as quoted by franceinfo, adds a modus operandi characteristic of the unit, the use of Farsi, and IP addresses pointing to terminals located in Iran.

Something else caught my eye, familia. C4 also observed concurrent targeting, which it links to the same attack, of Schneider Electric equipment at small hydroelectric installations in France, “with moderate effects.” Moderate. Not a blackout, not a dam failure. But if C4 is right, the same operators were touching energy gear the same week they were touching freezers.

The report also says Shahid Kaveh operates behind hacktivist personas, including one it spells CyberAveng3rs, which C4 says claimed the November 2023 campaign against Unitronics controllers. It names three IRGC figures in an annex. That’s context about the unit, as C4 states it. It doesn’t mean the 2023 campaign and this one are the same case.

On vendors: the formal French technical alert from October, CERTFR-2026-ALE-012, names Copeland and Dixell xweb and Danfoss AK-SC and AK-SM. Press reports of the prosecutor’s account mention Danfoss, Dixell and Copeland. The C4 attribution report itself doesn’t name those refrigeration brands.

The legal and diplomatic side

The Paris prosecutor opened a judicial investigation, an “information judiciaire,” against the head of Shahid Kaveh, his two deputies and anyone else identified. Per TF1 and The Record, the prosecutor requested international arrest warrants. Requested. I haven’t seen anything showing they were issued, and nobody has been arrested.

On November 10, Iran’s foreign ministry, quoted by BFMTV, “categorically” rejected what it called “unfounded and unilateral accusations.”

And the Telegram claims you may have seen from NoName057(16) and Z-Pentest about the November wave? Unit 42 flagged them as unverified, and they still are.

Bottom line

France officially attributed the October 11 to 12 French campaign to Iran’s Shahid Kaveh. Only that campaign. The November wave and the EFS incident are still unattributed.
Attribution is a bundle of indicators and a requested warrant, not a conviction. Iran denies it. Report it with that precision.
Three chapters in, the lesson holds: an exposed refrigeration controller is OT, and someone was willing to burn it.

Stay sharp out there.

Javier